| Message ID | 1467127346-23743-1-git-send-email-samuel.gauthier@6wind.com |
|---|---|
| State | Awaiting Upstream |
| Delegated to: | Pablo Neira |
| Headers | show |
On 28 June 2016 at 17:22, Samuel Gauthier <samuel.gauthier@6wind.com> wrote: > Only the first and last netlink message for a particular conntrack are > actually sent. The first message is sent through nf_conntrack_confirm when > the conntrack is committed. The last one is sent when the conntrack is > destroyed on timeout. The other conntrack state change messages are not > advertised. > > When the conntrack subsystem is used from netfilter, nf_conntrack_confirm > is called for each packet, from the postrouting hook, which in turn calls > nf_ct_deliver_cached_events to send the state change netlink messages. > > This commit fixes the problem by calling nf_ct_deliver_cached_events in the > non-commit case as well. > > Fixes: 7f8a436eaa2c ("openvswitch: Add conntrack action") > CC: Joe Stringer <joestringer@nicira.com> > CC: Justin Pettit <jpettit@nicira.com> > CC: Andy Zhou <azhou@nicira.com> > CC: Thomas Graf <tgraf@suug.ch> > Signed-off-by: Samuel Gauthier <samuel.gauthier@6wind.com> Acked-by: Joe Stringer <joe@ovn.org> -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
From: Samuel Gauthier <samuel.gauthier@6wind.com> Date: Tue, 28 Jun 2016 17:22:26 +0200 > Only the first and last netlink message for a particular conntrack are > actually sent. The first message is sent through nf_conntrack_confirm when > the conntrack is committed. The last one is sent when the conntrack is > destroyed on timeout. The other conntrack state change messages are not > advertised. > > When the conntrack subsystem is used from netfilter, nf_conntrack_confirm > is called for each packet, from the postrouting hook, which in turn calls > nf_ct_deliver_cached_events to send the state change netlink messages. > > This commit fixes the problem by calling nf_ct_deliver_cached_events in the > non-commit case as well. > > Fixes: 7f8a436eaa2c ("openvswitch: Add conntrack action") > CC: Joe Stringer <joestringer@nicira.com> > CC: Justin Pettit <jpettit@nicira.com> > CC: Andy Zhou <azhou@nicira.com> > CC: Thomas Graf <tgraf@suug.ch> > Signed-off-by: Samuel Gauthier <samuel.gauthier@6wind.com> Applied. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c index 3d5feede962d..d84312584ee4 100644 --- a/net/openvswitch/conntrack.c +++ b/net/openvswitch/conntrack.c @@ -818,8 +818,18 @@ static int ovs_ct_lookup(struct net *net, struct sw_flow_key *key, */ state = OVS_CS_F_TRACKED | OVS_CS_F_NEW | OVS_CS_F_RELATED; __ovs_ct_update_key(key, state, &info->zone, exp->master); - } else - return __ovs_ct_lookup(net, key, info, skb); + } else { + struct nf_conn *ct; + int err; + + err = __ovs_ct_lookup(net, key, info, skb); + if (err) + return err; + + ct = (struct nf_conn *)skb->nfct; + if (ct) + nf_ct_deliver_cached_events(ct); + } return 0; }
Only the first and last netlink message for a particular conntrack are actually sent. The first message is sent through nf_conntrack_confirm when the conntrack is committed. The last one is sent when the conntrack is destroyed on timeout. The other conntrack state change messages are not advertised. When the conntrack subsystem is used from netfilter, nf_conntrack_confirm is called for each packet, from the postrouting hook, which in turn calls nf_ct_deliver_cached_events to send the state change netlink messages. This commit fixes the problem by calling nf_ct_deliver_cached_events in the non-commit case as well. Fixes: 7f8a436eaa2c ("openvswitch: Add conntrack action") CC: Joe Stringer <joestringer@nicira.com> CC: Justin Pettit <jpettit@nicira.com> CC: Andy Zhou <azhou@nicira.com> CC: Thomas Graf <tgraf@suug.ch> Signed-off-by: Samuel Gauthier <samuel.gauthier@6wind.com> --- v1 -> v2: don't break OVS_CT_ATTR_COMMIT attribute This patch was tested against the net tree, checking the notifications with conntrack -E. net/openvswitch/conntrack.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)